Rewrite README as a short project front page; add a Nix flake

The README is now a landing page: the idea (a mesh VPN with no server, joined
with a network name and a secret), install and platform tables, exit nodes,
and a short build section. Implementation detail stays in docs/.

The flake builds tsng and the tray from source and ships a NixOS module
(services.tsunagi). Dist install notes now show the real `join -n -s` syntax,
and two links that pointed into the old README are redirected.

Co-Authored-By: Claude <noreply@anthropic.com>

flake.nix

@@ -0,0 +1,39 @@
+{
+  description = "tsunagi: serverless mesh VPN. A network name and a secret are all it takes.";
+
+  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
+
+  outputs =
+    { self, nixpkgs }:
+    let
+      systems = [
+        "x86_64-linux"
+        "aarch64-linux"
+      ];
+      forAllSystems = f: nixpkgs.lib.genAttrs systems (system: f nixpkgs.legacyPackages.${system});
+    in
+    {
+      packages = forAllSystems (pkgs: rec {
+        tsunagi = pkgs.callPackage ./nix/package.nix { };
+        tsunagi-cli = pkgs.callPackage ./nix/package.nix { withTray = false; };
+        default = tsunagi;
+      });
+
+      overlays.default = final: _prev: {
+        tsunagi = final.callPackage ./nix/package.nix { };
+        tsunagi-cli = final.callPackage ./nix/package.nix { withTray = false; };
+      };
+
+      nixosModules.default = import ./nix/module.nix self;
+
+      devShells = forAllSystems (pkgs: {
+        default = pkgs.mkShell {
+          inputsFrom = [ self.packages.${pkgs.stdenv.hostPlatform.system}.tsunagi ];
+          packages = [
+            pkgs.rustfmt
+            pkgs.clippy
+          ];
+        };
+      });
+    };
+}